Behind the Tech:  Stories Shaping Our Digital Future

Cyber Security

Inside the Battle Against Cybercrime: How Microsoft and Fortra Combat Hacker Threats

26 May

Written by: Exquitech Group

In a significant escalation of cybersecurity threats, hackers launched a sophisticated attack on Ireland's Health Service Executive (HSE) in 2021. By deploying a phishing scheme and a legacy version of Cobalt Strike, they compromised over 80% of the HSE's IT systems, putting patient lives and hospital operations at risk. This tool, designed for legitimate security testing, has been subverted by cybercriminals, who use it to infiltrate and disrupt systems globally. 

Rising Threats and Strategic Countermeasures 

The breach not only highlighted vulnerabilities within critical infrastructures but also underscored the evolving threat landscape in cyber warfare. Cobalt Strike, a tool once reserved for cybersecurity professionals to simulate attacks for network defenses, has been increasingly cracked and manipulated by hackers to carry out ransomware and malware attacks. Recognizing the severity of the threat, Microsoft and Fortra, the company that acquired Cobalt Strike in 2020, joined forces to combat the misuse of this powerful software. The partnership was solidified by a court order allowing them to seize and block infrastructure used to host and manage cracked versions of Cobalt Strike. This decisive action marked a critical step forward in disrupting the operations of cybercriminals who exploit this software. 

Microsoft's Digital Crimes Unit at the Forefront 

The initiative to neutralize cracked Cobalt Strike versions began with Microsoft's Digital Crimes Unit (DCU), which has been at the forefront of fighting cybercrime. The DCU's approach involves identifying and dismantling the command-and-control servers that facilitate the spread of ransomware via Cobalt Strike. By employing sophisticated tracking and analysis techniques, the DCU can differentiate between legitimate and illicit uses of the software, thanks to unique watermarks Fortra embeds in each legally sold kit. 

The Challenge of Distinguishing Legitimate from Illicit Use 

One of the major challenges in this operation was distinguishing between Cobalt Strike used for valid security testing and versions cracked for malicious intent. This differentiation is crucial to ensure that legitimate cybersecurity activities are not disrupted. The collaboration with Fortra provided the DCU with access to a database of watermarks associated with authorized versions of Cobalt Strike, greatly enhancing the accuracy of their crackdown. 

Fortra's Role and the Collaboration's Impact 

Fortra's involvement came after initial hesitation, recognizing the potential impact of their partnership with Microsoft. The company provided a list of over 200 illegitimate watermarks linked to approximately 3,500 unauthorized servers worldwide. This information was vital in scaling the operation, allowing for a more targeted and effective response to the misuse of Cobalt Strike. 

Legal Wins and Global Implications 

The collaboration between Microsoft and Fortra has led to significant legal victories. They have managed to link malicious infrastructure to specific cybercriminal groups and ransomware families, facilitating legal actions and domain seizures. These efforts have had a tangible impact, with a reported 25% reduction in detected cracked Cobalt Strike servers globally and even greater declines in the U.S. 

Ongoing Commitment and Future Directions 

Despite these successes, the battle against cybercrime is ongoing. Cybercriminals continue to adapt, seeking out jurisdictions with lax copyright enforcement to host their operations. Microsoft and Fortra remain committed to their long-term strategy of disrupting cybercriminal infrastructure and refining their techniques to respond to evolving threats. 

Conclusion 

The partnership between Microsoft and Fortra exemplifies a proactive and collaborative approach to cybersecurity. By joining forces, they have not only disrupted significant cybercriminal operations but also set a precedent for how private companies can work together to enhance global digital security. This initiative not only protects organizations and individuals but also contributes to the broader goal of creating a safer internet for everyone. 

This strategic alliance has demonstrated the power of collaboration in the fight against cybercrime, showcasing how combined resources and shared expertise can lead to substantial impacts in protecting critical infrastructures and enhancing cybersecurity globally.